15 January 2009. US Airways Flight 1549 takes off from LaGuardia at 3:25 p.m., heading for Charlotte. Just under a minute and a half later, at 2,800 feet over Manhattan, the Airbus A320 flies into a flock of Canada geese. Both engines lose thrust, almost simultaneously. What Captain Chesley “Sully” Sullenberger and First Officer Jeffrey Skiles do in the next three minutes is in no manual. There is no checklist for “dual engine flameout at 2,800 feet over Manhattan”. The engine restart procedure they work through for form’s sake is designed for altitudes above 20,000 feet. It doesn’t fit in the very first step. Sully decides not to bring the aircraft back to Teterboro airport as the tower suggests (he sees in twenty seconds that it won’t reach), but to set down on the Hudson. A decision no procedure provides for, because no procedure can. All 155 people on board survive.
In the later NTSB analysis it’s calculated that the aircraft could have reached Teterboro, had the crew turned immediately, without attempting the engine restart, without spending the seconds in which a human tries to assess the impossible. “Could have reached”, under conditions no one in the cockpit knew: a crew in the simulator, prepared for the scenario, with engine data that no one could realistically have had. Sully himself said in the hearing: It was not realistic. He was right.
This is the story that became a classic. It’s shown in trainings, quoted in talks, shared on LinkedIn. What’s rarely said about it is the place where it becomes uncomfortable, the place where praise for the captain and the safety logic of our industry should fall apart.
What saved Sully that day wasn’t the procedure. It was the willingness to set the procedure aside the moment it became clear it didn’t fit. It was the experience, built over thousands of flight hours, to position an aircraft in seconds against a geography he knew. It was a cockpit in which two people could communicate quickly and without hierarchical friction. And it was an organisation that had built enough trust over the preceding years that a captain took responsibility for a water landing. And was not rebuked afterwards for departing from the script.
In the dominant safety logic of our time, exactly this moment is an anomaly. “Human error” is the standard explanation for most incidents. What do we call what Sully did, in the same language?
The usual diagnosis
The usual diagnosis after an incident goes predictably. It runs in two steps: first “human error”, then “more standardisation”. Who should have done it better, what should they have done, which procedure wasn’t followed? The vocabulary is well-rehearsed, the conclusion usually stands before the investigation: more precise manual, sharper training, stronger compliance.
What this logic doesn’t reach is the asymmetry between what counts as “failure” and what gets registered as “success”. Sully is a hero today. The moment he left the restart checklist, every formally driven investigation would have had to read him as “procedural deviation under pressure”. Had the aircraft not reached the Hudson, Sully would today be an example of “inadequate procedural compliance”. The story hangs on the outcome, not the action.
This is exactly where Erik Hollnagel’s point in Safety-II in Practice becomes operational: the same behaviour we classify as failure after an incident is the condition under which the system makes it through most days. People continuously adapt procedures to a reality in which the procedures don’t fit. When things go well, no one talks about it. When things go wrong, the adaptation becomes the symptom that needs to be prevented.
This isn’t a methodological cosmetic flaw of incident investigations. It’s the structural foundation of a safety logic in which the term “human error” doesn’t describe what happened, but what shouldn’t have happened. A diagnosis that always already knows where the problem lies (with the human), and accordingly stops learning.
It would be too easy to file this reading pattern as mere knowledge lag. The Old View doesn’t survive because its proponents have read too little. It survives because it serves a set of institutional needs very efficiently. It delivers clear attribution: one person, one fault, one closed case. It fits insurance and liability logic, which asks about individual responsibility. It’s representable in executive reporting without loss in translation: Employee X didn’t follow procedure Y, training Z is the answer. Above all, it minimises the need to question the system itself (and with it the decisions of those who designed it). Arguing against all of this is not primarily a matter of better knowledge. It’s a matter of who bears the cost of the shift.
The unspoken truth
If we look honestly at an average workday in a high-risk organisation, we don’t see what’s in the manual. We see thousands of small adjustments, most of which are never written down. And without which the system wouldn’t survive.
A nurse combines orders because the original procedure doesn’t fit the specific situation. An industrial operator takes a step early because the tool named in the procedure is currently out for maintenance. A pilot follows the checklist in an order more fitting to the situation than the one prescribed in the manual. A firefighter sets the nozzle two metres closer than standard formation would dictate, because he reads the geometry of the fire differently.
What Hollnagel calls the efficiency-thoroughness trade-off (the constant balancing between effort and thoroughness that cannot be trained away under real conditions) is not an exception. It’s the form in which work is done. Steven Shorrock, in his articles on humanisticsystems.com, accordingly speaks of adjustments as the actual substance of safety: the constant, invisible stream of small corrections through which procedures stay connected to reality.
These adjustments don’t enter the statistics anywhere. They don’t show up in safety KPIs. They aren’t part of compliance reports. They happen because they have to. And because no one talks about them, no one knows how many there are daily or what they rest on. The organisation depends on a resilience whose existence it doesn’t officially acknowledge.
Exactly what the safety logic demands (strict procedural adherence) is what undermines safety under real conditions.
What Old View thinking costs
As long as the official logic addresses people as the weak link, this invisible adaptive work has an implicit status: it’s tolerated as long as nothing happens, and sanctioned the moment something does. This has two consequences, which together hollow out the organisation’s learning system.
First, employees learn (quickly, in every operation) that adjustments are best left undocumented. Whoever does something that deviates from the procedure and records it in a report risks consequences that don’t lie in the adjustment itself, but in the fact that it became visible. The rational response is not to make it visible. This costs the organisation its only access to the question of how it actually works.
Second, the employees whose adaptive work carries the system are simultaneously the ones to whom responsibility is assigned when the system nevertheless fails. This isn’t just unfair. It’s destructive. It trains people to think less, observe less, compensate less, because every compensation, if it becomes visible, can become an accusation.
What would work instead
The alternative isn’t: abolish procedures. The alternative is to treat procedures as what they are: a first approximation to a complex reality that must be recalibrated in every single application. What happens between procedure and application isn’t a defect. It’s the place where safety is produced.
In operational terms: make adjustment visible without elevating it to a new rule. An organisation that regularly asks where did we deviate from the procedure this week, why, and with what result learns something that audits can’t deliver. It learns how its work is actually done. Whoever doesn’t want to hear the answer shouldn’t ask. Whoever wants to hear it must be willing to adjust the procedure when needed, not the person who went around it in the moment of truth.
Todd Conklin’s HOP line makes a tool of this insight: Learning Teams instead of Investigations, Pre-Job Briefs instead of formalised Job Safety Analyses, Operational Learning instead of Root Cause Analysis. The shift in vocabulary isn’t cosmetic. It shifts the question from “who failed?” to “what haven’t we understood yet, and how do we understand it better next time?”.
In practice these are small, regular formats that work below the threshold of a formal investigation. A weekly Learning Team of 30 minutes, in which someone briefly tells where the procedure didn’t fit this week, without consequences, without documentation. A Pre-Job Brief before an unusual operation that asks what’s different this time and which assumption won’t hold today. An After-Action Review even after ordinary days, because every ordinary day contains something learnable. These formats are well known. They fail in most organisations not for lack of knowledge, but because they lead to nothing without psychological safety. Whoever admits something in the learning group that could later end up in their personnel file stays silent. And the learning group decays into an empty ritual.
This names a precondition that doesn’t exist in many organisations: that speaking without punishment is possible. Just Culture in the strict sense. Without this precondition, everything else stays cosmetic: HOP as well, Safety-II as well, the friendliest learning group in the world as well. With it, the invisible adaptive work becomes what it could be: the learning source of an organisation that wants to speak honestly about its own operations.
The uncomfortable question
Back to Sully, shortly after 3:31 p.m., one of the most unusual water landings in civil aviation. The story became a Hollywood film, the captain became a hero. What gets forgotten in the telling is the question that runs along in the background: in which organisation could he have done that, without being sanctioned afterwards for the procedural deviation?
In most high-risk industries the honest answer is: not in many. Whoever consistently treats their employees as the weak link will end up with employees who become exactly that, not out of malice, but out of self-protection. They will stop deviating from scripts, and resign themselves to the fact that a day on which something unforeseen happens simply won’t be a good day, because they have nothing left in hand that isn’t in the manual.
If safety is what we want, we have to stop reading the human as the problem to be fixed. We have the choice: either we treat adaptive work as what it is (the invisible substance of our safety), or we talk it away until there’s no one left to put the next aircraft down on the Hudson.
Sources
- Erik Hollnagel – Safety-II in Practice, Routledge 2018
- Steven Shorrock – Articles on humanisticsystems.com (Work-as-Done, Adjustments)
- Sidney Dekker – The Field Guide to Understanding Human Error, 3rd ed., CRC Press 2014
- Todd Conklin – Pre-Accident Investigations, Ashgate 2012
- NTSB – Accident Report AAR-10/03, Loss of Thrust in Both Engines After Encountering a Flock of Birds and Subsequent Ditching on the Hudson River, US Airways Flight 1549, 2010